Back to skill
Skillv1.0.3
ClawScan security
gate-news-briefing · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 7, 2026, 10:35 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are consistent with a read-only news-briefing tool that queries a Gate-News MCP server and aggregates results; it does not request credentials, install software, or access unrelated system resources.
- Guidance
- This skill appears internally consistent for producing short crypto news briefings: it only uses read-only MCP tools, asks for no secrets, and has no installer. Before installing, confirm you trust the Gate-News MCP server that the skill uses (the skill depends on that local/host MCP service for data). Also review the bundled reference files included in the package (they are small and readable) to ensure you are comfortable with the data sources and failure/degeneration behavior. If you do not have a trusted Gate-News MCP instance available, the skill will not return live headlines and will degrade gracefully per its rules.
Review Dimensions
- Purpose & Capability
- okThe name/description (news briefing) matches the declared behavior: calling three read-only MCP tools (events, news search, social sentiment) and aggregating results. No unrelated binaries, credentials, or config paths are requested.
- Instruction Scope
- noteRuntime instructions are narrowly scoped to: verify Gate-News MCP availability, call the three documented read-only MCP tools, deduplicate/aggregate results, and format a briefing. The skill asks the agent to read the bundled reference rule files (which are included in the package) and to avoid calling undocumented tools. One ambiguous line in the template mentions 'Full source of all included files' — this appears to be reviewer-facing or bundle-inspection guidance rather than a directive to exfiltrate unrelated files, but the wording could be clearer to avoid misinterpretation.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files. This is low-risk: nothing is downloaded or written to disk by the skill itself. It does require a local Gate MCP server to be present, but does not include an installer.
- Credentials
- okNo environment variables, credentials, or config paths are required. The skill explicitly states it's read-only and does not handle API secrets under normal execution.
- Persistence & Privilege
- okNo special persistence requested (always:false). The skill does not ask to modify other skills or system-wide settings. Autonomous invocation is allowed by platform default but is not combined here with any broad credentials or installation privileges.